Launch-state attestation does not by itself cover weights loaded later

Attestation measures launch state, and weights are read from disk after boot. A signature checked at load time does not stop a malicious hypervisor from altering the disk afterwards ¹. Tinfoil reports mitigating this with dm-verity checks on every read ¹. Unmeasured runtime configuration remains a general risk ⁶.